2.4 Firms, Managers and Compliance Officers
Key Takeaways
- SQE1 tests the SRA Code of Conduct for Firms as it applies to managers in authorised firms and to compliance officers; paragraph 8.1 makes managers responsible for the firm's compliance, jointly and severally if they share management.
- The COLP must take all reasonable steps on authorisation and regulatory arrangements other than the Accounts Rules; the COFA must take all reasonable steps on the Accounts Rules (paragraphs 9.1 and 9.2).
- A newly qualified solicitor is not usually a COLP or COFA, but is expected to identify which compliance role owns a breach and to escalate a serious compliance failure rather than resolve it privately.
What SQE1 actually tests on the Code for Firms
The SQE1 Assessment Specification does not require you to run a law firm. It requires functioning knowledge of the SRA Code of Conduct for Firms in relation to:
- managers in authorised firms; and
- compliance officers.
Together with the individual Code, these are "the Code of Conduct" for assessment purposes. Questions remain client-based: a partner's instruction, a missing client-account transfer, an NDA a client wants sent tonight, a reputation-management letter that reads like a SLAPP.
Official source: SRA Code of Conduct for Firms (current version in effect from 11 April 2025).
The Firms Code exists to create and maintain the right culture and systems for competent, ethical legal services. Paragraph 2.1 requires effective governance, systems and controls so that the firm and its people comply with SRA arrangements and other law, so that managers and interest holders do not cause or substantially contribute to a breach, and so that compliance officers can actually discharge paragraphs 9.1 and 9.2. Paragraph 2.2 requires records that demonstrate compliance. Paragraph 2.3 keeps the firm accountable even when work is done through employees or contractors.
Managers — paragraph 8.1
The SRA Glossary manager includes: the sole principal in a recognised sole practice; a member of an LLP; a director of a company; a partner in a partnership; or, for any other body, a member of its governing body.
Paragraph 8.1: if you are a manager, you are responsible for compliance by your firm with this Code. That responsibility is joint and several if you share management with other managers.
A newly qualified solicitor is usually not a manager. You still need the rule, because:
- a vignette may put you in a small firm where the only other solicitor is "the boss" who is the manager, COLP and COFA rolled into one;
- you must not cause or substantially contribute to the firm's breach;
- your reporting line is how the manager and COLP receive the facts they need.
Joint and several responsibility means a silent partner who "left compliance to the COLP" is still on the hook for the firm's systems. SQE1 will not ask you to apportion percentages of blame; it will ask whether the manager can treat the COLP as a dustbin for responsibility (no).
COLP and COFA — paragraphs 9.1 and 9.2
| Role | Full name | Core duty: take all reasonable steps to… |
|---|---|---|
| COLP | Compliance Officer for Legal Practice (HOLP in a licensable body) | Ensure compliance with the firm's authorisation; ensure the firm, managers, employees and interest holders comply with SRA regulatory arrangements except the Accounts Rules; ensure managers, interest holders and those they employ or contract with do not cause or substantially contribute to a breach; ensure a prompt report to the SRA of facts reasonably believed capable of amounting to a serious breach; and, separately, ensure the SRA is informed of facts that should be brought to its attention so it can investigate or exercise powers |
| COFA | Compliance Officer for Finance and Administration (HOFA in a licensable body) | Ensure the firm, managers and employees comply with the SRA Accounts Rules; ensure a prompt report of facts reasonably believed capable of amounting to a serious breach of the Accounts Rules; and the parallel "bring to the SRA's attention" duty in the accounts sphere |
The COLP's paragraph 9.1 duties are expressly save in relation to matters which are the responsibility of the COFA under 9.2. Missing client money is a COFA-facing Accounts Rules problem (and often also a Principle 1 / 4 / 5 problem for everyone who knew). A dishonest NDA template used across the employment team is a COLP-facing Code and authorisation problem.
SRA guidance on responsibilities of COLPs and COFAs adds functioning-knowledge detail you can use in a client scenario:
- the duty is all reasonable steps, not strict liability for every employee mistake;
- firms must decide how the roles operate, with reporting lines that empower the compliance officers, especially if they are employees rather than owners;
- compliance officers should keep a record of breaches as a risk-management tool (linked to paragraph 2.2);
- some matters are mandatory notifications; others require a judgment about a "serious breach" report.
Paragraph 7.12 of the individual Code is the newly qualified solicitor's practical valve: an obligation to notify or provide information to the SRA is satisfied if you provide the information to your firm's COLP or COFA, as and where appropriate, on the understanding that they will do so. You do not hide a serious breach in a private email to a friend at another firm. If you reasonably believe the COLP will not report, you are back on your own 7.7 / 7.8 duty to report to the SRA.
Day-one response on a firm-systems file
- Identify the client and the instruction.
- Name the Principle and the Code paragraph (individual and, if the instruction is "this is how the firm does it", the Firms Code).
- If public-interest Principles conflict with the instruction, they win — tell the client.
- Tell your supervisor. If it is a serious breach or missing money, tell the COLP or COFA as appropriate.
- Record what you knew, when, and what you did.
- Do not follow an instruction that would mislead a court, strip a person of a protected disclosure, or complete a transaction you know is a fraud.
A newly qualified solicitor finds that completion monies that should be in client account were paid, apparently on a partner's email, into an office account used to pay the firm's VAT bill. The partner says it will be "put back on Monday" and tells the solicitor not to bother the compliance team. Who must the solicitor involve, and why?